Timor Virus

 Virus Name:  Timor 
 V Status:    Rare 
 Discovery:   April, 1992 
 Symptoms:    .COM & .EXE file growth; TSR; message displayed on 
              November 12th 
 Origin:      Unknown 
 Eff Length:  1,562 - 1,576 Bytes 
 Type Code:   PRsA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  F-Prot, Sweep, ViruScan, IBMAV, PCScan, 
                    AVTK, NAV, NAVDX, VAlert, ChAV, 
                    NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, IBMAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Timor virus was received in April, 1992.  Its origin is 
       unknown.  Timor is a memory resident infector of .COM and .EXE 
       programs, and is based on the Jerusalem virus. 
       When the first Timor infector program is executed, the Timor virus 
       will install itself memory resident as a low system memory TSR of 
       2,816 bytes.  It will hook interrupts 21 and F8. 
       Once Timor is memory resident, it will infect .COM and .EXE 
       programs when they are executed.  .COM programs will have a file 
       length increase of 1,562 bytes with the virus being located at the 
       beginning of the infected file.  .EXE programs will have a file 
       length increase of 1,562 - 1,576 bytes with the virus being located 
       at the end of the infected file.  Unlike Jerusalem, Timor does not 
       reinfect .EXE files.  Infected programs will not have any change 
       to their date and time in the DOS disk directory. 
       The following text strings can be found in all Timor infected 
               "St       Cruz, Dili" 
               "sso, Freedom for East Timor !" 
               "1991 Nov 12, Lusitâia Expres" 
       Timor activates on November 12th of any year, at which time it 
       may display the message: "St Cruz, Dili". 
       See:  Jerusalem 

Show viruses from discovered during that infect .

Main Page